Unsecured File Access Vulnerability in Sunnet's eHRD CTMS

CVE-2024-10439

What is CVE-2024-10439?

The eHRD CTMS, a product developed by Sunnet, is affected by an Insecure Direct Object Reference (IDOR) vulnerability. This flaw enables unauthenticated remote attackers to exploit the system by modifying specific parameters, granting them unauthorized access to arbitrary files uploaded by any user. Such vulnerabilities pose significant security risks, as they allow attackers to retrieve sensitive information stored within the application without proper authentication protocols in place. Organizations utilizing eHRD CTMS are advised to implement rigorous security measures to mitigate potential exploitation.

References